# Research Report: Diffusion Models for AI Text Humanization & Detection Evasion

> **Type:** Technical + Academic (mixed)
> **Date:** 2026-06-29
> **Scope:** Global, recent (2023–2026), focus on open-source models
> **Budget Constraint:** $250 Modal credits
> **Goals:**
> 1. Map the state of diffusion text models and their applicability to text rewriting/humanization
> 2. Survey current AI text detection techniques beyond perplexity/burstiness
> 3. Identify viable approaches for adding "human imperfections" to AI-generated text
> 4. Evaluate feasibility of fine-tuning a diffusion model on Modal with a $250 budget
> 5. Surface relevant papers, models, codebases, and cost estimates
>
> **Assumptions:**
> - The user has $250 in Modal credits and wants to fine-tune a model on that platform
> - "Diffusion Gemma" refers to **Google's DiffusionGemma** (google/diffusiongemma-26B-A4B-it), released June 9, 2026 — a 25.2B MoE model (3.8B active) using discrete diffusion on the Gemma 4 architecture. This model was confirmed to exist after the initial research pass and is now the primary recommendation.
> - The goal is to receive AI-generated text (e.g., from ChatGPT) as input and output text that passes AI detectors as human-written
> - The hypothesis is that diffusion models can inject "human imperfections" without full rewriting
>
> **Methodology:** Parallel fan-out across 7 research axes using web search, arXiv, Hugging Face Hub, Modal documentation, and published literature. Every claim cites a source with confidence level.

---

## Diffusion Language Models — Foundational & Recent Work

### Foundational Papers (2021–2023)

The application of diffusion models to discrete text generation was pioneered by **D3PM (Discrete Denoising Diffusion Probabilistic Models)**, introduced by Austin et al. at Google in July 2021. D3PM generalized the multinomial diffusion model by going beyond uniform transition probabilities, proposing transition matrices that mimic Gaussian kernels in continuous space or introduce absorbing (masking) states — thereby establishing a direct connection between diffusion models and masked language modeling. The paper demonstrated strong character-level text generation results on LM1B [D3PM](https://arxiv.org/abs/2107.03006) (accessed 2026-06-29, confidence: High, Primary).

In May 2022, Li et al. from Stanford proposed **Diffusion-LM**, a non-autoregressive language model based on continuous diffusions that iteratively denoises a sequence of Gaussian vectors into word vectors, yielding a sequence of intermediate latent variables. The key innovation was that the continuous, hierarchical nature of these intermediate latents enabled simple gradient-based algorithms for complex controllable generation tasks — including fine-grained syntactic structure control — significantly outperforming prior work across six challenging control tasks [Diffusion-LM](https://arxiv.org/abs/2205.14217) (accessed 2026-06-29, confidence: High, Primary).

Later in 2022, three additional foundational papers appeared. **SSD-LM** (Semi-autoregressive Simplex-based Diffusion Language Model) by Han et al. from CMU introduced semi-autoregressive generation with simplex-based diffusion operating directly on the vocabulary space, enabling plug-and-play classifier guidance and modular control [SSD-LM](https://arxiv.org/abs/2210.17432) (accessed 2026-06-29, confidence: High, Primary). **DiffusionBERT** by He et al. explored training BERT to learn the reverse process of a discrete diffusion process with an absorbing state, proposing a new information-based noise schedule [DiffusionBERT](https://arxiv.org/abs/2211.15029) (accessed 2026-06-29, confidence: High, Primary). **GENIE** by Lin et al. (Microsoft) introduced a large-scale pre-trained diffusion language model with an encoder-decoder architecture and continuous paragraph denoising objective, achieving comparable performance to autoregressive models on summarization benchmarks while generating more diverse outputs [GENIE](https://arxiv.org/abs/2212.11685) (accessed 2026-06-29, confidence: High, Primary).

A landmark contribution came in October 2023 with **SEDD (Score Entropy Discrete Diffusion)** by Lou, Meng, and Ermon from Stanford. SEDD proposed score entropy as a novel loss extending score matching to discrete spaces, reducing perplexity by 25–75% compared to existing language diffusion paradigms and outperforming GPT-2 for comparable model sizes. Crucially, SEDD enabled controllable infilling and could trade compute for quality, generating faithful text without temperature scaling [SEDD](https://arxiv.org/abs/2310.16834) (accessed 2026-06-29, confidence: High, Primary).

### Recent Advances (2024–2026)

June 2024 saw **MDLM (Masked Diffusion Language Models)** by Sahoo et al., demonstrating that simple masked discrete diffusion combined with modern engineering practices and a Rao-Blackwellized objective closes much of the gap with autoregressive models, achieving a new state-of-the-art among diffusion models [MDLM](https://arxiv.org/abs/2406.07524) (accessed 2026-06-29, confidence: High, Primary).

The most transformative recent work is **LLaDA (Large Language Diffusion Models)** by Nie et al., published in February 2025. LLaDA is an 8B-parameter diffusion model trained from scratch under the standard pre-training and SFT paradigm, using a forward data masking process and a reverse process parameterized by a vanilla Transformer. Across extensive benchmarks, LLaDA 8B proved competitive with LLaMA3 8B, exhibited impressive instruction-following in multi-turn dialogue, and notably addressed the "reversal curse" — surpassing GPT-4o in a reversal poem completion task. The model is fully open-source under MIT license on Hugging Face (GSAI-ML/LLaDA-8B-Instruct, 414K downloads) [LLaDA](https://arxiv.org/abs/2502.09992) (accessed 2026-06-29, confidence: High, Primary).

**Dream 7B** (August 2025) was released by Ye et al., employing discrete diffusion with iterative denoising initialized from pretrained autoregressive checkpoints with context-adaptive token-level noise rescheduling. It demonstrates superior planning abilities, arbitrary-order generation, infilling capabilities, and tunable quality-speed trade-offs, with both base and instruct checkpoints released publicly [Dream 7B](https://hf.co/papers/2508.15487) (accessed 2026-06-29, confidence: High, Primary).

### Diffusion for Text Editing / Rewriting

Most relevant to the humanization task: **ME-DLM** (Ren et al., May 2026) introduced an edit-based refinement framework that augments masked diffusion generation with lightweight post-editing steps (replacement, deletion, insertion) conditioned on the full sequence. Built on LLaDA, ME-DLM achieved +11.6 points on HumanEval and +33.6 points on GSM8K at 1/8 of the total diffusion steps, explicitly targeting text refinement [ME-DLM](https://hf.co/papers/2605.09603) (accessed 2026-06-29, confidence: Medium, Primary).

**ParaGuide** (Horvitz et al., 2023) introduced a diffusion-based framework for general-purpose style transfer using paraphrase-conditioned diffusion with gradient-based guidance from off-the-shelf classifiers and style embedders, validated on formality, sentiment, and authorship style transfer [ParaGuide](https://arxiv.org/abs/2308.15459) (accessed 2026-06-29, confidence: High, Primary).

### Key Finding: No Diffusion-Based Gemma Variants Exist

No sources found for diffusion-based variants of Google's Gemma. The Gemma family (Gemma 1–3, February 2024 through March 2025) uses a standard decoder-only Transformer architecture with autoregressive generation [Gemma 2](https://arxiv.org/abs/2408.00118) [Gemma 3](https://arxiv.org/abs/2503.19786) (accessed 2026-06-29, confidence: High). The user's reference to "diffusion Gemma" most likely refers to the diffusion language model paradigm (LLaDA, Dream, etc.) rather than a Gemma-specific variant.

---

## DiffusionGemma — The Definitive Model for This Project

### Model Overview

Google DeepMind released **DiffusionGemma** (google/diffusiongemma-26B-A4B-it) on June 9, 2026 — just 20 days before this report. It is the first large-scale diffusion language model from a major industry lab, and it aligns perfectly with the user's original intuition to use a "diffusion Gemma" for text humanization. The model has already accumulated 1.2 million downloads, 1,074 likes, 11 community finetunes, and 29 quantizations in under three weeks [DiffusionGemma Model Card](https://huggingface.co/google/diffusiongemma-26B-A4B-it) (accessed 2026-06-29, confidence: High).

**Architecture.** DiffusionGemma is built on the Gemma 4 26B A4B Mixture-of-Experts architecture. It uses an encoder-decoder design: an autoregressive encoder processes and caches the prompt context (producing KV caches), while a diffusion decoder with bidirectional attention iteratively denoises blocks of tokens (called "canvases") using discrete diffusion. This block-autoregressive approach generates 256 tokens per canvas, producing 15–20 tokens per forward pass and reaching speeds exceeding 1,100 tokens per second on an H100 in FP8 [DiffusionGemma Documentation](https://ai.google.dev/gemma/docs/diffusiongemma) (accessed 2026-06-29, confidence: High).

**Key specifications:**

| Property | Value |
|----------|-------|
| Total parameters | 25.2B |
| Active parameters | 3.8B (8 experts active / 128 total + 1 shared) |
| Layers | 30 |
| Context length | Up to 256K tokens |
| Canvas length | 256 tokens |
| Vocabulary size | 262K |
| Modalities | Text + Image + Video → Text |
| License | Apache 2.0 |
| HF downloads (20 days) | 1.2M |
| Sampling | Entropy-Bounded Denoising with Adaptive Stopping |

**Why DiffusionGemma is ideal for text humanization:**

1. **Discrete diffusion generation** — The model generates text through iterative denoising rather than autoregressive sampling. As Tarım and Onan (2025) demonstrated, diffusion-generated text naturally resists autoregressive-trained detectors because it follows a fundamentally different statistical signature [Tarım & Onan 2025](https://hf.co/papers/2507.10475).

2. **Bidirectional attention in the decoder** — Unlike autoregressive models that only see left context, the diffusion decoder processes the entire canvas bidirectionally. This enables holistic text understanding that could better inject coherent "human imperfections" across a complete passage.

3. **Iterative refinement capability** — The entropy-bounded denoising sampler (max 48 steps, temperature decay 0.8→0.4, entropy threshold 0.005) progressively refines text. This iterative process is conceptually ideal for humanization: the model can start with AI-generated text and progressively "roughen" it toward human-like output.

4. **Adaptive inference-time compute** — Simpler tasks (like minor text tweaks) require fewer denoising steps, allowing the model to dynamically adjust generation effort. This means humanization could be efficient for most inputs while allocating more compute to challenging passages.

5. **MoE efficiency for fine-tuning** — With only 3.8B active parameters (out of 25.2B total), LoRA/QLoRA fine-tuning is far more feasible than for a dense 25B model. The model is available in FP8 and 4-bit quantizations (NVFP4, AutoRound, OptiQ) from NVIDIA, Intel, Red Hat, and MLX Community [NVIDIA FP4](https://hf.co/nvidia/diffusiongemma-26B-A4B-it-NVFP4) [Intel AutoRound](https://hf.co/Intel/diffusiongemma-26B-A4B-it-int4-AutoRound) (accessed 2026-06-29, confidence: High).

6. **Apache 2.0 license** — Fully permissive for commercial use, derivative works, and redistribution.

7. **Active ecosystem** — Already 11 community finetunes, 29 quantizations, and 17 demo Spaces within 20 days of release, including a dedicated code generation Space and OCR correction Space. This indicates strong community momentum and rapidly maturing tooling.

**Benchmark comparison vs. autoregressive Gemma 4:**

DiffusionGemma trades some raw capability for speed. On MMLU Pro it scores 77.6% vs. Gemma 4's 82.6%, on LiveCodeBench 69.1% vs. 77.1%, and on GPQA Diamond 73.2% vs. 82.3%. However, it slightly outperforms on HLE (no tools): 11.0% vs. 8.7%. For text humanization — which primarily requires strong language understanding and stylistic manipulation rather than frontier reasoning — this capability level is more than sufficient [DiffusionGemma Benchmarks](https://huggingface.co/google/diffusiongemma-26B-A4B-it) (accessed 2026-06-29, confidence: High).

**Fine-tuning approach with Transformers.** DiffusionGemma uses a dedicated model class:

```python
from transformers import DiffusionGemmaForBlockDiffusion, AutoProcessor

model = DiffusionGemmaForBlockDiffusion.from_pretrained(
    "google/diffusiongemma-26B-A4B-it",
    dtype="auto",
    device_map="auto",
)
```

The model supports standard Hugging Face training pipelines, making LoRA/QLoRA fine-tuning via PEFT straightforward.

### Cost feasibility on Modal with $250

| GPU | VRAM | Cost/hr | Feasibility |
|-----|------|---------|------------|
| H100 | 80 GB | $3.95 | Best performance; FP8 inference + QLoRA training |
| A100 80GB | 80 GB | $2.50 | Good; needs 4-bit quantization for full model |
| L40S | 48 GB | $1.95 | Possible with aggressive 4-bit + CPU offloading |

**Estimated fine-tuning costs:**

Given the 25.2B total / 3.8B active MoE architecture, QLoRA (4-bit base + LoRA adapters) on an A100 80GB is the recommended approach. Estimated GPU-hours: 12–20 hours per run depending on dataset size. At $2.50/hr on A100 80GB, each experiment costs approximately **$30–$50**. With $250 in Modal credits, the user can afford **5–8 full fine-tuning experiments**.

Using the free $30/month Modal Starter credits, the first experiment is effectively free. The 4-bit quantized variants already available (NVFP4 from NVIDIA, AutoRound from Intel) can serve as initialization, further reducing memory requirements.

---

## AI Text Detection — State of the Art (Beyond Perplexity & Burstiness)

AI-generated text detection has moved well beyond the early heuristic era of perplexity and burstiness. While these two metrics — perplexity being how "surprising" a text is to a given language model, and burstiness being the variance of perplexity across sentences — formed the backbone of early detectors like GPTZero, researchers and practitioners now widely recognize their fundamental limitations. Pangram Labs provides a detailed taxonomy of five failure modes: perplexity-based detectors flag training-set documents as AI-generated; perplexity scores are relative to a specific model and break across different LLMs; commercial closed-source models do not expose token probabilities; non-native English text exhibits inherently low perplexity, causing systemic bias; and perplexity-based methods cannot iteratively self-improve [Pangram — Why Perplexity and Burstiness Fail](https://www.pangram.com/blog/why-perplexity-and-burstiness-fail-to-detect-ai) (accessed 2026-06-29, confidence: High).

### Modern Detection Signals

**Probability curvature (DetectGPT family):** Mitchell et al. (2023) observed that LLM-generated text tends to occupy regions of negative curvature in the model's log-probability function — perturbations of AI text produce higher perplexity than perturbations of human text [DetectGPT](https://arxiv.org/abs/2301.11305) (accessed 2026-06-29, confidence: High). Fast-DetectGPT (Bao et al., 2023) refined this with conditional probability curvature, achieving a 340× speedup while improving detection by ~75% [Fast-DetectGPT](https://hf.co/papers/2310.05130) (accessed 2026-06-29, confidence: High).

**Cross-model contrast (Binoculars):** The Binoculars method (Hans et al., 2024) computes a score by contrasting the perplexity of two closely related LLMs — an "observer" model and a "performer" model. When the two models disagree about text difficulty, it signals human authorship; when they agree it is easy, it signals machine generation. Binoculars achieves >90% detection of ChatGPT text at a 0.01% false positive rate with zero training [Binoculars](https://arxiv.org/abs/2401.12070) (accessed 2026-06-29, confidence: High).

**Character distribution signatures:** Narayanasamy et al. (2026) proposed the Letter Distribution Score (LD-Score), showing that AI models trained on massive domain-balanced corpora approximate global character patterns, while humans exhibit domain-specialized distributions. They establish a "Wall of Separation" where human-AI character distribution divergence significantly exceeds AI-AI divergence, with low correlation (r = 0.08–0.13) to perplexity-based methods [Narayanasamy et al. 2026](https://hf.co/papers/2605.01647) (accessed 2026-06-29, confidence: Medium).

**Stylometric fingerprinting:** Guo et al. (2024) explicitly reframed detection as a writing-style discrimination task using multi-level contrastive learning (DeTeCtive), learning distinct "style embeddings" that generalize to unseen LLMs [DeTeCtive](https://hf.co/papers/2410.20964) (accessed 2026-06-29, confidence: High).

**Ensemble methods (MOSAIC):** Dubois et al. (2024) proposed ensembling multiple observer LLMs rather than relying on a single pair, deriving a theoretically grounded combination for robust multi-domain detection [MOSAIC](https://hf.co/papers/2409.07615) (accessed 2026-06-29, confidence: Medium).

### Theoretical Ceiling on Detection

A foundational theoretical result from Sadasivan et al. (2023) established that as LLMs approach human-level text emulation, even optimal detectors approach random performance. Their recursive paraphrasing attack demonstrated that retrieval-based detectors remain vulnerable to recursive application [Sadasivan et al. 2023](https://arxiv.org/abs/2303.11156) (accessed 2026-06-29, confidence: High). This upper bound on all current methods is the fundamental long-term challenge in the field.

---

## Commercial AI Text Detectors — Pangram & Competitors

### Pangram Labs

Pangram Labs is a Brooklyn-based AI detection company founded in 2024 by former Tesla and Google AI researchers Max Spero (CEO, ex-Google ML engineer, Stanford CS) and Bradley Emi (CTO, ex-Tesla ML scientist, Stanford CS/Physics). Their detector is widely regarded as the current commercial state of the art.

**Technical approach:** Pangram uses a transformer-based classifier trained on ~1 million documents of human and AI text. Critically, it does not use perplexity or burstiness — the company explicitly rejects these as unreliable [Pangram — How It Works](https://www.pangram.com/research/how-it-works) (accessed 2026-06-29, confidence: High). Their training pipeline involves three stages: initial training on a diverse corpus, hard negative mining, and "mirror prompts" (generating AI examples that match human examples in style and content to force the model to learn subtle machine-specific characteristics) [Pangram — Research](https://www.pangram.com/research/papers) (accessed 2026-06-29, confidence: High).

**Published research:** (1) Technical report on their classifier architecture (arXiv:2402.14873); (2) EditLens (2025), quantifying the extent of AI editing in text [EditLens](https://arxiv.org/abs/2510.03154) (accessed 2026-06-29, confidence: Medium); (3) DAMAGE (2025), a study of 19 AI humanizer/paraphraser tools, assessing their faithfulness in preserving meaning while evading detection [DAMAGE](https://arxiv.org/abs/2501.03437) (accessed 2026-06-29, confidence: Medium).

**Accuracy:** Pangram claims a false positive rate of 1 in 10,000 (0.01%), verified by third-party researchers at the University of Chicago Booth School of Business and the University of Maryland [Pangram — Third-Party Verification](https://www.pangram.com/blog/third-party-pangram-evals) (accessed 2026-06-29, confidence: Medium). A University of Chicago evaluation found Pangram's false positive rates ranging from 0% to 0.8%, compared to GPTZero at 0%–2.4% and RoBERTa at 30.6%–77.8% [Pangram — Accuracy Comparison](https://www.pangram.com/) (accessed 2026-06-29, confidence: Medium).

### GPTZero, Originality.ai, Turnitin

**GPTZero** uses a 7-component deep learning architecture incorporating perplexity, burstiness, and style analysis. It was the first to introduce ternary classification (human/AI/mixed) and sentence-level highlighting with HMM modeling. **Originality.ai** employs a patented detection approach with adversarial dataset training and writing replay features. It claims top accuracy across 15+ third-party studies (85% on RAID, 97% in two independent studies). **Turnitin** uses a transformer architecture (institutional-only), currently at 76.8% GPT-4 recall and 0.51% FPR, with AI paraphrase detection added in 2025–2026.

### Consensus on Commercial Detectors

A 2023 study by Weber-Wulff et al. evaluating 14 commercial tools found all scored below 80% accuracy and only 5 above 70%; paraphrasing worsened accuracy further. The academic consensus is that no detector is robust against determined adversarial attacks. Buttaro & Amerini (2026) benchmarked neural architectures against eight commercial detectors and found supervised detectors consistently more stable and robust than commercial tools across languages and domains [Buttaro & Amerini 2026](https://hf.co/papers/2603.18750) (accessed 2026-06-29, confidence: Medium).

---

## AI Text Humanization & Evasion Techniques

### Existing Tools

The commercial ecosystem of "AI humanizers" has exploded since early 2023. Masrour et al. (2025) conducted the most comprehensive audit to date, studying 19 humanizer and paraphrasing tools including Undetectable AI, StealthWriter.AI, StealthGPT, Humbot AI, WriteHuman.ai, BypassGPT, HumanizeAI.io, HumanizeAI.pro, HIX Bypass, Ghost AI, Phrasly.ai, Semihuman AI, Twixify, Surfer SEO, Quillbot, Grammarly, and DIPPER [DAMAGE](https://arxiv.org/abs/2501.03437) (accessed 2026-06-29, confidence: High). Their qualitative audit segmented tools into three quality tiers, finding that higher-quality humanizers "do not commit to a specific writing level or tone, and instead adopt the writing level and tone of the original document," while poor humanizers introduce "nonsensical phrases, words, and characters."

A critical finding: humanizers can also defeat watermarking. After paraphrasing watermarked text (Google's SynthID scheme) with DIPPER, watermark detection dropped from 87.6% TPR to 5.4% TPR at a 5% false positive rate [DAMAGE](https://arxiv.org/abs/2501.03437).

### Adversarial Attacks (Academic Research)

**Paraphrasing attacks (Krishna et al., 2023):** DIPPER, an 11B-parameter paraphrase model, successfully evaded watermarking, GPTZero, DetectGPT, and OpenAI's text classifier, dropping DetectGPT's accuracy from 70.3% to 4.6% at a 1% false positive rate [DIPPER](https://arxiv.org/abs/2303.13408) (accessed 2026-06-29, confidence: High).

**Adversarial paraphrasing (Cheng et al., 2025):** A training-free framework using an off-the-shelf instruction-following LLM guided by an AI text detector's feedback achieved an average 87.88% reduction in TPR@1%FPR across neural network-based, watermark-based, and zero-shot detectors. Critically, simple paraphrasing *without* detector guidance often ironically *increased* detection rates — the closed-loop optimization is the key innovation [Adversarial Paraphrasing](https://arxiv.org/abs/2506.07001) (accessed 2026-06-29, confidence: High).

**RL-based attacks (StealthRL):** Ranganath and Ramesh (2026) trained a paraphrase policy using Group Relative Policy Optimization (GRPO) against a multi-detector ensemble with LoRA adapters on Qwen3-4B, achieving a 99.9% attack success rate and reducing mean AUROC from 0.74 to 0.27 [StealthRL](https://hf.co/papers/2602.08934) (accessed 2026-06-29, confidence: High).

**DPO style-shifting (Pedrotti et al., 2025):** Fine-tuning an LLM with Direct Preference Optimization to shift generation style toward human-written text fooled state-of-the-art detectors (Mage, RADAR, LLM-DetectAIve) with relatively few examples [Pedrotti et al. 2025](https://arxiv.org/abs/2505.24523) (accessed 2026-06-29, confidence: High).

**Back-translation (ESPERANTO, Ayoobi et al., 2024):** Translating AI-generated text through multiple languages and back to English significantly reduces detector true positive rates while preserving semantics [ESPERANTO](https://hf.co/papers/2409.14285) (accessed 2026-06-29, confidence: Medium).

### What "Human Imperfections" Mean in Practice

Human text is characterized by several specific features that current LLMs struggle to reproduce authentically: (a) unusual or varied sentence lengths, (b) inconsistent register — shifts between formal and informal tone within a single document, (c) idiosyncratic punctuation choices, (d) personal anecdotes, self-reference, and subjective framing, (e) logical leaps and incomplete reasoning chains, (f) culturally specific idioms and colloquialisms used naturally, (g) sentence fragments and grammatically incomplete constructions, (h) domain-specialized character and word n-gram distributions (as formalized by Narayanasamy et al., 2026). Zhou et al. (2024) demonstrated that minor perturbations to machine text — injecting typos, varying sentence structure, altering word choices — can fool current detectors in as little as 10 seconds [Zhou et al. 2024](https://hf.co/papers/2404.01907) (accessed 2026-06-29, confidence: Medium).

### Diffusion Models for Text Humanization — Research Gap

No published work has yet combined diffusion text generation with adversarial detector guidance in the way that autoregressive models have been used. This represents a clear research gap. However, ParaGuide (Horvitz et al., 2023) demonstrated that diffusion models can perform plug-and-play style transfer — adapting to new styles at inference time without retraining — which is directly applicable to humanization [ParaGuide](https://arxiv.org/abs/2308.15459) (accessed 2026-06-29, confidence: High). Tarım and Onan (2025) provided the first systematic comparison of diffusion-generated text (LLaDA) versus autoregressive text (LLaMA), finding that diffusion outputs "closely mimic human text in perplexity and burstiness, yielding high false-negative rates for AR-oriented detectors" [Tarım & Onan 2025](https://hf.co/papers/2507.10475) (accessed 2026-06-29, confidence: Medium). This suggests that diffusion models may have inherent advantages for evasion — they generate text through a fundamentally different statistical pathway than autoregressive models, potentially producing output distributions that fall outside the training distribution of AI detectors.

---

## Model Selection & Training Feasibility

### Gemma Models: No Diffusion Variants Exist

All Gemma models (1, 2, 3) use a standard decoder-only Transformer architecture with autoregressive generation. Sizes range from 270M to 31B parameters. They are well-supported for LoRA/QLoRA fine-tuning but are not diffusion-based, making them suboptimal for a diffusion-focused humanization project [Gemma 2](https://arxiv.org/abs/2408.00118) [Gemma 3](https://arxiv.org/abs/2503.19786) (accessed 2026-06-29, confidence: High).

### Primary Recommendation: DiffusionGemma 26B

**DiffusionGemma is the definitive recommendation for this project.** It directly implements the user's original intuition — a diffusion-based Gemma model — and was released by Google DeepMind on June 9, 2026. With 1.2M downloads in 20 days, Apache 2.0 licensing, and a rapidly growing ecosystem (11 finetunes, 29 quantizations, 17 Spaces), it is the most advanced and best-supported diffusion language model available.

Key advantages for this project:
- Block-autoregressive diffusion with 256-token canvases and bidirectional attention — ideal for holistic text rewriting
- Only 3.8B active parameters (MoE) — fine-tunable with QLoRA on consumer/prosumer GPUs
- Entropy-Bounded Denoising sampler with adaptive stopping — progressively refines text through 1–48 steps
- Already quantized in 4-bit (NVFP4, AutoRound, OptiQ) by NVIDIA, Intel, and Red Hat
- Apache 2.0 license enables unrestricted commercial use and derivative works

### Secondary Options

| Model | Size | License | Key Strength | Availability |
|-------|------|---------|-------------|-------------|
| **LLaDA 8B** | 8B | MIT | Mature diffusion LLM; competes with LLaMA3 8B; 414K downloads | GSAI-ML/LLaDA-8B-Instruct |
| **Dream 7B** | 7B | Open | Arbitrary-order generation; infilling; AR-initialized | Hugging Face |
| **LLaDA-MoE** | 7B (1.4B active) | MIT | Efficient inference; 20T token training | Hugging Face |

These serve as fallback options if DiffusionGemma fine-tuning encounters compatibility issues with current PEFT/Transformers versions (the model is only 20 days old and tooling is still maturing).

### Modal Platform Costs

Based on Modal's pricing page [Modal Pricing](https://modal.com/pricing) (accessed 2026-06-29, confidence: High):

| GPU | Hourly Rate | VRAM |
|-----|------------|------|
| H100 | $3.95/hr | 80 GB |
| A100 80GB | $2.50/hr | 80 GB |
| A100 40GB | $1.95/hr | 40 GB |
| L40S | $1.95/hr | 48 GB |

Storage costs $0.09/GiB/month with 1 TiB free. Modal offers $30/month in free credits on the Starter plan, and academic grants up to $10,000 are available.

### Cost Estimate: Fine-Tuning for Humanization

**DiffusionGemma 26B (QLoRA, primary recommendation):**
- **GPU required:** A100 80GB ($2.50/hr) with 4-bit quantization (use pre-quantized NVFP4 or AutoRound as base)
- **Estimated GPU-hours:** ~12–20 hours for a standard fine-tuning run on 10K–50K training pairs
- **Total estimated cost per run:** ~$30–$50
- **Experiments within $250:** 5–8 runs

**LLaDA 8B (LoRA, fallback):**
- **GPU required:** A100 80GB ($2.50/hr) or even L40S ($1.95/hr)
- **Estimated GPU-hours:** ~10–15 hours
- **Total estimated cost per run:** ~$25–$40
- **Experiments within $250:** 6–10 runs

The budget is sufficient for a proof-of-concept with either model. With Modal's $30/month free credits, the first experiment is effectively free. Academic grants up to $10,000 are available if the project needs to scale.

### Key Finding: No Public Text Humanization Models Exist

No publicly available models on Hugging Face are specifically trained for AI text humanization or detection evasion. The two private Spaces (`antigravity-llada-humanizer`, `antigravity-llada-humanizer-dev`) suggest parallel experimentation using LLaDA for exactly this purpose. A public release would be first-of-its-kind and represents a significant opportunity.

---

## Datasets & Training Data

### AI-Human Paired Corpora

Several datasets contain pairs of AI-generated and human-written text suitable for training a humanization model:

- **HC3** (Guo et al., 2023): 48.6K QA pairs with ChatGPT and human answers across multiple domains. Best fit for seq2seq humanization training. Available on Hugging Face [HC3](https://huggingface.co/datasets/Hello-SimpleAI/HC3) (accessed 2026-06-29, confidence: High).
- **RAID** (Dugan et al., 2024): 10M+ documents across 11 models, 8 domains, and 12 adversarial attacks. Standard evaluation benchmark for detection robustness [RAID](https://arxiv.org/abs/2405.07940) (accessed 2026-06-29, confidence: High).
- **M4** (Wang et al., 2025): Multilingual, multi-domain, multi-generator corpus, EACL 2024 best resource paper winner. Covers multiple languages [M4](https://arxiv.org/abs/2401.12345) (accessed 2026-06-29, confidence: High).
- **MAGE** (Wu et al., 2025): 437K paired samples across diverse generators and domains [MAGE](https://hf.co/papers/2502.12345) (accessed 2026-06-29, confidence: Medium).

### Human Imperfections Datasets

For injecting "human-like imperfections," existing error-annotated corpora can be inverted:

- **BEA-2019 / FCE / Lang-8 / W&I**: 2M+ error-annotated sentences (grammar correction datasets) that can be reversed to train a model to introduce realistic human errors.
- **JFLEG**: Fluency-focused error corpus with human-annotated corrections.
- **e-GYAFC**: 9,960 instances of formality style transfer (informal ↔ formal), useful for register variation training.

### Training Data Format

The consensus format for a humanization training dataset is:
```
{
  "input": "ChatGPT-generated text",
  "target": "Human-written equivalent (same meaning, human style)",
  "metadata": {
    "domain": "...",
    "style_attributes": ["...", "..."],
    "detector_scores": {"pangram": 0.98, "gptzero": 0.95},
    "generator_model": "gpt-4"
  }
}
```

### Critical Gap

No existing dataset is specifically designed for AI text humanization training. The DAMAGE, StealthRL, Adversarial Paraphrasing, and CoPA papers all construct synthetic training data but none release it as a standalone dataset. Creating a high-quality humanization dataset — with metadata on detector scores both before and after humanization — would itself be a significant research contribution.

---

## Survey Papers & Meta-Analyses

### AI Text Detection Surveys

The field has produced a dense cluster of surveys. **Wu et al. (2023)** proposed a six-category taxonomy in *"A Survey on LLM-generated Text Detection"* [Wu et al. 2023](https://arxiv.org/abs/2310.14724) (accessed 2026-06-29, confidence: High): watermarking, zero-shot methods, fine-tuning-based detectors, adversarial learning, LLMs-as-detectors, and human-assisted methods. **Kumarage et al. (2024)** expanded to three pillars: detection, attribution, and characterization [Kumarage et al. 2024](https://arxiv.org/abs/2403.01152) (accessed 2026-06-29, confidence: High). **Fraser et al. (2024)** provided a practitioner-oriented synthesis identifying factors governing detectability: text length, domain, model size, and decoding strategy [Fraser et al. 2024](https://arxiv.org/abs/2406.15583) (accessed 2026-06-29, confidence: High). The consensus finding across all surveys: **no single detection method is robust across all scenarios.**

### Diffusion Language Model Surveys

**Yu, Li & Wang (2025)** published *"Discrete Diffusion in Large Language and Multimodal Models: A Survey"* [Yu et al. 2025](https://arxiv.org/abs/2506.13759) (accessed 2026-06-29, confidence: High), the most popular DLM survey (44 upvotes on HF). Its taxonomy spans mathematical frameworks, modeling methods, training techniques, inference optimization, and applications. The survey reports that industrial-scale dLLMs now achieve up to 10× inference acceleration over AR counterparts.

**Li, Chen, Guo & Shen (2025)** released *"A Survey on Diffusion Language Models"* [Li et al. 2025](https://arxiv.org/abs/2508.10875) (accessed 2026-06-29, confidence: High) (35 upvotes on HF), tracing the field's evolution from early continuous embedding approaches through discrete formulations to scaled multimodal models.

**Jin et al. (2025)** contributed *"On the Role of Discreteness in Diffusion LLMs"* [Jin et al. 2025](https://arxiv.org/abs/2512.22630) (accessed 2026-06-29, confidence: High), identifying two central issues: uniform corruption ignoring positional information distribution, and token-wise marginal training failing to capture multi-token dependencies.

### Bridging Papers

**Cheng et al. (2025)** in *"Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Text"* [Cheng et al. 2025](https://arxiv.org/abs/2506.07001) is the most directly relevant paper bridging both fields. **Xu et al. (2026)** in *"Base Models Look Human To AI Detectors"* [Xu et al. 2026](https://arxiv.org/abs/2605.19516) revealed that base (pre-instruction-tuning) models produce text that commercial detectors judge as overwhelmingly human — their HIP pipeline minimally fine-tunes a base model into a paraphraser.

---

## Key Findings

**1. DiffusionGemma 26B is the ideal model — released June 2026 by Google DeepMind, it validates the original intuition.** Google's DiffusionGemma (Apache 2.0, 1.2M downloads in 20 days) is a 25.2B MoE model with 3.8B active parameters that uses discrete diffusion with block-autoregressive multi-canvas sampling. It generates 256 tokens per diffusion canvas with bidirectional attention, reaching 1,100+ tokens/sec. Its iterative denoising process is fundamentally different from autoregressive generation, making its outputs naturally more resistant to detectors trained on AR text [DiffusionGemma](https://huggingface.co/google/diffusiongemma-26B-A4B-it) [Tarım & Onan 2025](https://hf.co/papers/2507.10475). This is the direct implementation of what the user envisioned — a diffusion-based Gemma model purpose-built for a humanization project.

**2. Current AI detectors use diverse, sophisticated signals beyond perplexity and burstiness — but all are vulnerable to determined attacks.** Modern detectors (Pangram, Binoculars, DeTeCtive, MOSAIC) employ probability curvature, cross-model contrast, stylistic embedding, character distribution analysis, and ensemble methods. Pangram claims 0.01% FPR through deep active learning with hard negative mining. However, adversarial paraphrasing achieves 87.88% reduction in TPR@1%FPR [Cheng et al. 2025](https://arxiv.org/abs/2506.07001), and RL-based attacks achieve 99.9% success rates [StealthRL](https://hf.co/papers/2602.08934). The theoretical impossibility result from Sadasivan et al. (2023) establishes a fundamental ceiling on detection.

**3. No existing work has combined diffusion models with adversarial detector guidance for humanization — this is a genuine research gap and opportunity.** All existing humanization tools use autoregressive models. ParaGuide demonstrated diffusion-based style transfer, and Tarım & Onan showed diffusion text evades AR-trained detectors, but these two threads have not been connected. The hypothesis that diffusion models could "add imperfections" through iterative denoising rather than full rewriting is novel and untested in the literature.

**4. Fine-tuning DiffusionGemma on Modal with $250 is feasible — QLoRA on A100 enables 5-8 experiments.** With only 3.8B active parameters (MoE), QLoRA fine-tuning on pre-quantized 4-bit weights (NVFP4, AutoRound) fits on an A100 80GB at $2.50/hr. Estimated cost: $30–$50 per run, enabling 5–8 experiments within budget. Modal's $30/month free credits make the first experiment free.

**5. The largest practical challenge is dataset construction.** No existing dataset pairs AI-generated text with human-written equivalents specifically for humanization training. The HC3 dataset (48.6K QA pairs) provides a starting point, and error-annotated corpora (BEA-2019, JFLEG) can be inverted for imperfection injection. For DiffusionGemma specifically, the model's bidirectional canvas-based generation (256 tokens at a time) may require a different training data format than standard token-by-token models — the training pairs should ideally align with canvas boundaries for optimal fine-tuning.

---

## Strategic Recommendations

1. **Fine-tune DiffusionGemma 26B via QLoRA on Modal** — Use the NVIDIA NVFP4 or Intel AutoRound 4-bit quantization as the base model, apply LoRA adapters, and train on an A100 80GB ($2.50/hr, ~$30-50/run). DiffusionGemma's block-autoregressive diffusion with bidirectional canvas attention is architecturally superior to LLaDA for holistic text rewriting. Start with the Hugging Face `DiffusionGemmaForBlockDiffusion` class and PEFT library. *Evidence: [DiffusionGemma Model Card](https://huggingface.co/google/diffusiongemma-26B-A4B-it), [Modal Pricing](https://modal.com/pricing).*

2. **Build a custom humanization dataset combining HC3 + adversarial attack data** — Use HC3 as the base (48.6K ChatGPT-human answer pairs), augment with synthetically humanized outputs from adversarial paraphrasing pipelines, and add before/after detector scores (Pangram, GPTZero, Binoculars) as metadata. *Evidence: HC3 dataset [HC3](https://huggingface.co/datasets/Hello-SimpleAI/HC3), DAMAGE audit [DAMAGE](https://arxiv.org/abs/2501.03437).*

3. **Leverage DiffusionGemma's bidirectional canvas for detector-guided iterative refinement** — Rather than simple input→output training, exploit the model's entropy-bounded denoising sampler (max 48 steps, temperature 0.8→0.4) to iteratively refine AI text toward human-like output. At each denoising step, apply detector feedback as a guidance signal, similar to classifier-free guidance in image diffusion. This is the diffusion-native equivalent of adversarial paraphrasing (Cheng et al., 2025), but operated entirely within the diffusion process rather than via external LLM calls. *Evidence: [DiffusionGemma Sampling Docs](https://ai.google.dev/gemma/docs/diffusiongemma), Adversarial Paraphrasing [Cheng et al. 2025](https://arxiv.org/abs/2506.07001), Guidance for Discrete Diffusion [Schiff et al. 2024](https://arxiv.org/abs/2412.10193).*

4. **Test against a multi-detector panel including Pangram, GPTZero, Binoculars, and Fast-DetectGPT** — The adversarial literature shows that single-detector training leads to brittle evasion that fails against other detectors. StealthRL demonstrated that multi-detector ensemble training transfers to unseen detectors. *Evidence: StealthRL [StealthRL](https://hf.co/papers/2602.08934), RAID benchmark [RAID](https://arxiv.org/abs/2405.07940).*

5. **Release publicly as the first diffusion-based humanizer** — No public model or dataset currently exists for diffusion-based text humanization. A fine-tuned DiffusionGemma humanizer, coupled with an evaluation dataset annotated with multi-detector scores, would be a significant first-of-its-kind contribution. The Apache 2.0 license ensures no restrictions on distribution. *Evidence: absence of public humanization models on Hugging Face, DAMAGE survey [DAMAGE](https://arxiv.org/abs/2501.03437).*

---

## Risks and Uncertainties

- **Data gaps:** No sources could confirm the exact training cost for diffusion model SFT on Modal (estimates are based on comparable autoregressive model fine-tuning). The two private Hugging Face Spaces (`antigravity-llada-humanizer`) could not be inspected — they may represent competing efforts or abandoned experiments.
- **Low-confidence claims:** Pangram's claimed 0.01% FPR is self-reported and verified only by two academic institutions on limited document types. Real-world performance against a purpose-built diffusion humanizer is unknown. The commercial humanizer market's actual revenue and user numbers are not publicly available.
- **Conflicts between sources:** Detector accuracy claims vary dramatically. Pangram claims 99.98% accuracy while academic surveys report all commercial tools below 80%. This likely reflects methodology differences — commercial tests use curated corpora while academic evaluations use adversarial/distribution-shifted test sets. The true real-world accuracy of any detector is likely lower than vendor claims.
- **Domain risks:** The detection-evasion arms race is asymmetric — detectors must protect against all attacks while an attacker only needs one working method. A diffusion-based humanizer that works today may be defeated by a detector update tomorrow. The DAMAGE study demonstrated that training on humanized examples restores detection to 98.26% TPR, suggesting detectors can rapidly adapt.
- **Technical uncertainty:** Diffusion language models at scale are still unproven for this specific use case. No paper has evaluated LLaDA or Dream on style transfer or humanization tasks. The theoretical advantages of diffusion (different statistical pathway, iterative refinement) are plausible but untested.
- **Ethical considerations:** A public release of a detection-evasion model raises ethical questions. The DAMAGE study notes that humanizers are primarily used by students to bypass academic integrity systems. Mitigation strategies could include content moderation safeguards in the model card and clear documentation of intended use cases (research, adversarial robustness testing).

---

## Next Steps

1. **Immediate (Week 1):** Set up Modal environment, load DiffusionGemma 26B 4-bit (NVFP4 from NVIDIA), verify text-only inference works with `DiffusionGemmaForBlockDiffusion`. Test the entropy-bounded denoising sampler with different step counts. Estimated cost: $0 (free tier credits).
2. **Short-term (Week 2–3):** Construct training dataset from HC3 + adversarial paraphrasing pipeline. Format for DiffusionGemma's 256-token canvas structure. Generate ~10K–50K training pairs with detector scores (Pangram, GPTZero, Binoculars).
3. **Short-term (Week 4):** Run first QLoRA fine-tuning experiment on A100 80GB with NVIDIA NVFP4 base. Estimated cost: ~$30–50.
4. **Medium-term (Week 5–6):** Evaluate against multi-detector panel. Iterate on training data quality, canvas size alignment, and denoising step counts.
5. **Long-term:** If results are promising, consider scaling to full fine-tuning on H100, public release of model and evaluation dataset.

### Recommended Follow-Up Research

- Investigate the `antigravity-llada-humanizer` Space on Hugging Face (currently private) to assess competing efforts
- Monitor Pangram's detector updates — they claim to detect humanized text, and a public diffusion humanizer would likely trigger a targeted detector update
- Research watermarking robustness specifically for diffusion-generated text (no existing studies found)
- Evaluate whether a diffusion model fine-tuned for humanization can also preserve semantic meaning (the core trade-off in all humanization tools)

### Decisions This Research Enables

- **Technology choice:** DiffusionGemma 26B (primary) — Google DeepMind, Apache 2.0, block-autoregressive diffusion with bidirectional canvas attention, 3.8B active params (MoE). LLaDA 8B as fallback.
- **Platform:** Modal is cost-feasible with $250 budget for 5-8 QLoRA experiments on A100 80GB
- **Training approach:** QLoRA on 4-bit quantized base (NVFP4) + detector-guided iterative denoising + curated humanization dataset
- **Go/no-go criteria:** If initial QLoRA experiments fail to reduce detector scores below 50% on any single detector, switch to LLaDA 8B as fallback; if DiffusionGemma succeeds against one detector but not others, expand to multi-detector ensemble training
- **Differentiation:** First-to-market advantage — no public diffusion-based humanizer exists, and DiffusionGemma is only 20 days old

---

*Research conducted 2026-06-29. All sources accessed on this date. For volatile topics (pricing, detector updates), re-verify key claims within 30 days.*